summaryrefslogtreecommitdiffstats
path: root/sys/net
Commit message (Collapse)AuthorAgeFilesLines
* Fix style(9) nits, whitespace and parentheses.thompsa2006-05-161-61/+52
|
* The current routing code allows insertion of indirect routes that haveqingli2006-05-161-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | gateways which are unreachable except through the default router. For example, assuming there is a default route configured, and inserting a route "route add 64.102.54.0/24 60.80.1.1" is currently allowed even when 60.80.1.1 is only reachable through the default route. However, an error is thrown when this route is utilized, say, "ping 64.102.54.1" will return an error This type of route insertion should be disallowed becasue: 1) Let's say that somehow our code allowed this packet to flow to the default router, and the default router knows the next hop is 60.80.1.1, then the question is why bother inserting this route in the 1st place, just simply use the default route. 2) Since we're not talking about source routing here, the default router could very well choose a different path than using 60.80.1.1 for the next hop, again it defeats the purpose of adding this route. Reviewed by: ru, gnn, bz Approved by: andre
* Recalculate IP checksum after running pfil hooks.dhartmei2006-05-151-2/+17
| | | | | Reviewed by: thompsa Tested by: Adam McDougall <mcdouga9@egr.msu.edu>
* Remove ip6fw. Since ipfw has full functional IPv6 support now and - inmlaier2006-05-121-2/+2
| | | | contrast to ip6fw - is properly lockes, it is time to retire ip6fw.
* Remove various bits of conditional Alpha code and fixup a few comments.jhb2006-05-122-6/+5
|
* Correct test for fragmented packet.hsu2006-05-111-1/+1
|
* Pickup locks for the BPF interface structure. It's quite possible thatcsjp2006-05-071-0/+2
| | | | | | | bpf(4) descriptors can be added and removed on this interface while we are processing stats. MFC after: 2 weeks
* In rtrequest and rtinit check for sa_len != 0 for the givenbz2006-05-041-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | destination. These checks are needed so we do not install a route looking like this: (0) 192.0.2.200 UH tun0 => When removing this route the kernel will start to walk the address space which looks like a hang on 64bit platforms because it'll take ages while on 32bit you should see a panic when kernel debugging options are turned on. The problem is in rtrequest1: if (netmask) { rt_maskedcopy(dst, ndst, netmask); } else bcopy(dst, ndst, dst->sa_len); In both cases the len might be 0 if the application forgot to set it. If so ndst will be all-zero leading to above mentioned strange routes. This is an application error but we must not fail/hang/panic because of this. Looks ok: gnn No objections: net@ (silence) MFC after: 8 weeks
* Add support for fragmenting ipv4 packets.thompsa2006-04-291-7/+85
| | | | | | | | | | | The packet filter may reassemble the ip fragments and return a packet that is larger than the MTU of the sending interface. There is no check for DF or icmp replies as we can only get a large packet to fragment by reassembling a previous fragment, and this only happens after a call to pfil(9). Obtained from: OpenBSD (mostly) Glanced at by: mlaier MFC after: 1 month
* Use ANSI C function protypes and declarations for if_arcsubr.rwatson2006-04-122-34/+14
| | | | MFC after: 1 month
* Correct an assertion in raw_uattach(): this is a library call that otherrwatson2006-04-091-1/+6
| | | | | | | | | protocols invoke after allocating a PCB, so so_pcb should be non-NULL. It is only used by the two IPSEC implementations, so I didn't hit it in my testing. Reported by: pjd MFC after: 3 months
* Undo damage from wrong MFC to HEAD.andre2006-04-041-38/+0
| | | | Pointed out by: jkim, remko
* MFC rev. 1.32: Add link status descriptions and related structures for userlandandre2006-04-041-0/+38
| | | | | | applications. Approved by: re
* In raw and raw-derived socket types, maintain and enforce invariant thatrwatson2006-04-011-19/+7
| | | | | | | the so_pcb pointer on the socket is always non-NULL. This eliminates countless unnecessary error checks, replacing them with assertions. MFC after: 3 months
* Chance protocol switch method pru_detach() so that it returns voidrwatson2006-04-013-30/+24
| | | | | | | | | | | | | | | | | | | | | | | | | rather than an error. Detaches do not "fail", they other occur or the protocol flags SS_PROTOREF to take ownership of the socket. soclose() no longer looks at so_pcb to see if it's NULL, relying entirely on the protocol to decide whether it's time to free the socket or not using SS_PROTOREF. so_pcb is now entirely owned and managed by the protocol code. Likewise, no longer test so_pcb in other socket functions, such as soreceive(), which have no business digging into protocol internals. Protocol detach routines no longer try to free the socket on detach, this is performed in the socket code if the protocol permits it. In rts_detach(), no longer test for rp != NULL in detach, and likewise in other protocols that don't permit a NULL so_pcb, reduce the incidence of testing for it during detach. netinet and netinet6 are not fully updated to this change, which will be in an upcoming commit. In their current state they may leak memory or panic. MFC after: 3 months
* Change protocol switch pru_abort() API so that it returns void ratherrwatson2006-04-012-9/+4
| | | | | | | | | | | | | | than an int, as an error here is not meaningful. Modify soabort() to unconditionally free the socket on the return of pru_abort(), and modify most protocols to no longer conditionally free the socket, since the caller will do this. This commit likely leaves parts of netinet and netinet6 in a situation where they may panic or leak memory, as they have not are not fully updated by this commit. This will be corrected shortly in followup commits to these components. MFC after: 3 months
* Add IFF_NEEDSGIANT to kernel PPP support. I have no idea why this wasn'trwatson2006-03-301-1/+1
| | | | | | here, but it should have been. MFC after: 3 days
* Assert that the mbuf is not shared to ensure problems like the last commit arethompsa2006-03-261-0/+3
| | | | not reintroduced.
* m_dup () packet not m_copypacket () since we will modify it. For morerik2006-03-231-2/+11
| | | | | | | | | | | details see PR kern/94448. PR: kern/94448 Original patch: Eygene A. Ryabinkin <rea-fbsd at rea dot mbslab dot kiae dot ru>Final patch: thompsa@ Tested by: thompsa@, Eygene A. Ryabinkin MFC after: 7 days
* No direct call to carp_ifdetach() anymore. It is called byglebius2006-03-211-6/+0
| | | | | | | event handler. PR: kern/82908 Submitted by: Dan Lukes <dan obluda.cz>
* Add kqueue(2) support on if_tap(4) interfaces. While I'm here, replaceemax2006-03-161-60/+153
| | | | | | | | | K&R style function declarations with ANSI style. Also fix endian bugs accessing ioctl arguments that are passed by value. PR: kern/93897 Submitted by: Vilmos Nebehaj < vili at huwico dot hu > MFC after: 1 week
* Add link status descriptions and related structures for userlandandre2006-03-151-0/+38
| | | | | | | | | | applications. Open[BGP|OSPF]D make use of this to determine the link status of interfaces to make the right routing descisions. Obtained from: OpenBSD MFC after: 3 days
* - Fill in the correct rtm_index for RTM_ADD and RTM_CHANGE messages.andre2006-03-152-1/+15
| | | | | | | | | | | | | | | | | | | - Allow RTM_CHANGE to change a number of route flags as specified by RTF_FMASK. - The unused rtm_use field in struct rt_msghdr is redesignated as rtm_fmask field to communicate route flag changes in RTM_CHANGE messages from userland. The use count of a route was moved to rtm_rmx a long time ago. For source code compatibility reasons a define of rtm_use to rtm_fmask is provided. These changes faciliate running of multiple cooperating routing daemons at the same time without causing undesired interference. Open[BGP|OSPF]D make use of these features to have IGP routes override EGP ones. Obtained from: OpenBSD (claudio@) MFC after: 3 days
* Don't acquire a lock before calling vlan_unconfig().ru2006-03-091-2/+0
| | | | | | This fixes a panic when doing "ifconfig ... -vlandev". OK'ed by: glebius
* If we miss the LINK_UP event from the network interface then the bridge portthompsa2006-03-062-13/+11
| | | | | | | | | will remain in the disabled state until another link event happens in the future (if at all). Add a timer to periodically check the interface state and recover. Reported by: Nik Lam <freebsdnik j2d.lam.net.au> MFC after: 3 days
* Unbreak byte counters when network interfaces are in monitor mode bycsjp2006-03-031-8/+8
| | | | | | | | | | re-organizing the monitor return logic. We perform interface monitoring checks after we have determined if the CRC is still on the packet, if it is, m_adj() is called which will adjust the packet length. This ensures that we are not including CRC lengths in the byte counters for each packet. Discussed with: andre, glebius
* Since we are using random ethernet addresses for the bridge, it is possiblethompsa2006-03-031-6/+21
| | | | | | | | that we might have address collisions, so make sure that this hardware address isn't already in use on another bridge. Submitted by: csjp MFC after: 1 month
* Slightly re-worked bpf(4) code associated with bridging: if we have acsjp2006-03-031-10/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | destination interface as a member of our bridge or this is a unicast packet, push it through the bpf(4) machinery. For broadcast or multicast packets, don't bother with the bpf(4) because it will be re-injected into ether_input. We do this before we pass the packets through the pfil(9) framework, as it is possible that pfil(9) will drop the packet or possibly modify it, making it very difficult to debug firewall issues on the bridge. Further, implemented IFF_MONITOR for bridge interfaces. This does much the same thing that it does for regular network interfaces: it pushes the packet to any bpf(4) peers and then returns. This bypasses all of the bridge machinery, saving mutex acquisitions, list traversals, and other operations performed by the bridging code. This change to the bridging code is useful in situations where individuals use a bridge to multiplex RX/TX signals from two interfaces, as is required by some network taps for de-multiplexing links and transmitting the RX/TX signals out through two separate interfaces. This behaviour is quite common for network taps monitoring links, especially for certain manufacturers. Reviewed by: thompsa MFC after: 1 month Sponsored by: Seccuris Labs
* Fix up the Bridge Identifier field in the BPDU packet.thompsa2006-02-281-15/+30
| | | | | | | | | | - use the cu_bridge_id rather than the cu_rootid for the bridge address [1] - the memcmp return value is not signed so the wrong interface may have been selected - fix up the calculation of sc_bridge_id PR: kern/93909 [1] MFC after: 3 days
* This patch fixes a problem, which exists if you have IPSEC in your kernelwkoszek2006-02-271-0/+2
| | | | | | | | | | | and want to have crypto support loaded as KLD. By moving zlib to separate module and adding MODULE_DEPEND directives, it is possible to use such configuration without complication. Otherwise, since IPSEC is linked with zlib (just like crypto.ko) you'll get following error: interface zlib.1 already present in the KLD 'kernel'! Approved by: cognet (mentor)
* Don't to forget to unlock the rwlock on trunk before destroying it.yar2006-02-241-2/+3
| | | | | | This should fix panic on "kldunload if_vlan" while vlanX are still there. Reviewed by: glebius
* Fix build.glebius2006-02-151-2/+2
|
* - Introduce ifmedia_baudrate(), which returns correct baudrate of theglebius2006-02-142-2/+82
| | | | | | | given media status. [1] - Utilize ifmedia_baudrate() in miibus_statchg() to update ifp->if_baudrate. Obtained from: NetBSD [1]
* Bump the MODULE_VERSION for HEAD, as the vlan(4) API is different inemaste2006-02-101-1/+1
| | | | | | | RELENG_6, and would require a lower version number. Requested by: glebius Approved by: rwatson (mentor)
* Avoid frobbing IFF_UP at any cost (which is close toyar2006-02-101-2/+0
| | | | | | | | zero in this case.) A kernel driver has IFF_DRV_RUNNING at its full disposal while IFF_UP may be toggled only by humans or their daemonic deputies from the userland. MFC after: 3 days
* Add a MODULE_VERSION so that other modules (perhaps third-party) canemaste2006-02-091-0/+1
| | | | | | depend on this one. Approved by: rwatson (mentor)
* The code in rn_walktree_from() that checks if we backed up too farqingli2006-02-071-1/+9
| | | | | | | | | | | | did not stop at the right node. Change the backtracking check from smaller-than to smaller-or-equal to prevent this from happening. While here fix one additional problem where the insertion of the default route traversed the entire tree. PR: kern/38752 Submitted by: qingli (before I became committer) Reviewed by: andre MFC after: 3 days
* Remove two unnecessary type casts, of which both had a typo inqingli2006-02-071-2/+2
| | | | | | | it anyways. Approved by: andre MFC after: 3 days
* Properly initialize args structure before passing it to ipfw_chk(): havingoleg2006-02-032-0/+2
| | | | | | | | uninitialized args.inp is unhealthy for uid/gid/jail ipfw rules. PR: kern/92589 Approved by: glebius (mentor) MFC after: 1 week
* In vlan_config() first call vlan_inithash(), then lock mutex, becauseglebius2006-02-021-4/+6
| | | | vlan_inithash() calls malloc(M_WAITOK).
* define lock.h before rwlock.h for DEBUG_LOCKScsjp2006-02-021-0/+1
|
* Implement SIOCGIFCONF for 32bit binaries.ps2006-02-022-0/+31
|
* Use PFIL_HOOKED macros in if_bridge and pass the right argument tocsjp2006-02-021-10/+10
| | | | | | | rw_assert. This un-breaks the build. Submitted by: Kostik Belousov Pointy hat to: csjp
* Somewhat re-factor the read/write locking mechanism associated with the packetcsjp2006-02-022-111/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | filtering mechanisms to use the new rwlock(9) locking API: - Drop the variables stored in the phil_head structure which were specific to conditions and the home rolled read/write locking mechanism. - Drop some includes which were used for condition variables - Drop the inline functions, and convert them to macros. Also, move these macros into pfil.h - Move pfil list locking macros intp phil.h as well - Rename ph_busy_count to ph_nhooks. This variable will represent the number of IN/OUT hooks registered with the pfil head structure - Define PFIL_HOOKED macro which evaluates to true if there are any hooks to be ran by pfil_run_hooks - In the IP/IP6 stacks, change the ph_busy_count comparison to use the new PFIL_HOOKED macro. - Drop optimization in pfil_run_hooks which checks to see if there are any hooks to be ran, and returns if not. This check is already performed by the IP stacks when they call: if (!PFIL_HOOKED(ph)) goto skip_hooks; - Drop in assertion which makes sure that the number of hooks never drops below 0 for good measure. This in theory should never happen, and if it does than there are problems somewhere - Drop special logic around PFIL_WAITOK because rw_wlock(9) does not sleep - Drop variables which support home rolled read/write locking mechanism from the IPFW firewall chain structure. - Swap out the read/write firewall chain lock internal to use the rwlock(9) API instead of our home rolled version - Convert the inlined functions to macros Reviewed by: mlaier, andre, glebius Thanks to: jhb for the new locking API
* Fix two bugs with the bridgethompsa2006-01-311-3/+17
| | | | | | | | | | | | - code expects memcmp() to return a signed value, our memcmp() returns 0 if args are equal and > 0 if not. - It's possible to hijack interface for static entry. If bridge recieves packet from interface marked as learning it will replace the bridge_rtnode entry for the source address even if such entry marked as static. Submitted by: Gleb Kurtsov <k-gleb yandex.ru> MFC after: 3 days
* Set IFF_BROADCAST and IFF_MULTICAST on vlan interfaces from theyar2006-01-311-2/+5
| | | | | | | | | | | | | | | | | | beginning and simply refuse to attach to a parent without either flag. Our network stack cannot handle well IFF_BROADCAST or IFF_MULTICAST on an interface changing on the fly. E.g., IP will or won't assign a broadcast address to an interface and join the all-hosts multicast group on it depending on its IFF_BROADCAST and IFF_MULTICAST settings. Should the flags alter later, IP will miss the change and keep using bogus settings. This can lead to evil things like supplying an invalid broadcast address or trying to leave a multicast group that hasn't been joined. So just avoid touching the flags since an interface was created. This has no practical purpose. Discussed with: -net, glebius, oleg MFC after: 1 week
* Merge the //depot/user/yar/vlan branch into CVS. It contains some collectiveglebius2006-01-306-130/+480
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | work by yar, thompsa and myself. The checksum offloading part also involves work done by Mihail Balikov. The most important changes: o Instead of global linked list of all vlan softc use a per-trunk hash. The size of hash is dynamically adjusted, depending on number of entries. This changes struct ifnet, replacing counter of vlans with a pointer to trunk structure. This change is an improvement for setups with big number of VLANs, several interfaces and several CPUs. It is a small regression for a setup with a single VLAN interface. An alternative to dynamic hash is a per-trunk static array with 4096 entries, which is a compile time option - VLAN_ARRAY. In my experiments the array is not an improvement, probably because such a big trunk structure doesn't fit into CPU cache. o Introduce an UMA zone for VLAN tags. Since drivers depend on it, the zone is declared in kern_mbuf.c, not in optional vlan(4) driver. This change is a big improvement for any setup utilizing vlan(4). o Use rwlock(9) instead of mutex(9) for locking. We are the first ones to do this! :) o Some drivers can do hardware VLAN tagging + hardware checksum offloading. Add an infrastructure for this. Whenever vlan(4) is attached to a parent or parent configuration is changed, the flags on vlan(4) interface are updated. In collaboration with: yar, thompsa In collaboration with: Mihail Balikov <mihail.balikov interbgc.com>
* Add some initial locking to gif(4). It doesn't covers the whole driver,glebius2006-01-302-25/+22
| | | | | | | | | | | | | | however IPv4-in-IPv4 tunnels are now stable on SMP. Details: - Add per-softc mutex. - Hold the mutex on output. The main problem was the rtentry, placed in softc. It could be freed by ip_output(). Meanwhile, another thread being in in_gif_output() can read and write this rtentry. Reported by: many Tested by: Alexander Shiryaev <aixp mail.ru>
* Make sure buffers in if_bridge are fully initialized before copyingcperciva2006-01-251-0/+3
| | | | | | them to userland. Security: FreeBSD-SA-06:06.kmem
* Be consistent in checking ifa->ifa_addr for NULL.yar2006-01-231-1/+1
| | | | | Found by: Coverity Prevent (tm) MFC after: 3 days
OpenPOWER on IntegriCloud